NCSC при отделе инноваций и обучения MOND

[email protected]
2021-08-23
, Huawei, Xiaomi OnePlus
,
(NCSC)
, 5G, .
Huawei, Xiaomi OnePlus.
Huawei, Xiaomi OnePlus - .1 2. 2020 (5G). Huawei P40 5G.3, Xiaomi Mi 10T 5G4
OnePlus 8T 5G5 . , ,
1.
Huawei P40 5G 1: , .
Xiaomi Mi 10T 5G OnePlus 8T 5G
1 CNET. «Huawei, OnePlus : , ». https://www.cnet.com/news/huawei-oneplus-china-biggest-smartphone-brands-you-should-know-about-lenovomeizu- xiaomi-oppo-vivo/
. 14% / 2020 .; Xiaomi , Huawei Samsung .https://www.counterpointresearch.com/european-smartphone-market-2020/
Huawei. Huawei P40 5G.https://consumer.huawei.com/en/phones/p40pro/ specs/ Xiaomi. Xiaomi Mi 10T 5G.https://www.mi.com/global/mi-10t-pro/specs/ OnePlus. OnePlus 8T 5G.https://www.oneplus.com/lt/8t/specs
2
3
NCSC MOND [email protected]
, 2017 21
; CVE (Common Vulnerabilities and Exposures), 9
6 Xiaomi (8
), 144 7 Huawei
(28 2020 ; 23 - 2021 ),
, 2020
, - party SMS
, .8
, .9,10 , , , , .
, Huawei, Xiaomi OnePlus,
10 . 4
, ,
.
, ,
2021 . , .
, Huawei
. Huawei
,
AppGallery .
Huawei,
AppGallery; ,
. , ,
,
. ,
, ,
. , ,
, ,
;
,
.
Xiaomi;
,
, Tencent, , ,
6 CVE https://www.cvedetails.com/vulnerability-list/vendor_id-19038/MI.html
CVE. https://www.cvedetails.com/vendor/16036/Oneplus.html
BusinessChief. https://businesschief.asia/technology/chinese-smartphone-brand-xiaomi-beats-apple- -
. https://fortune.com/2020/11/25/xiaomi-third-quarter-results-largest-western-europe/
7 Huawei .
9
10
2
, . , Mi Browser : Google
Analytics Sensor Data. Google Analytics, ,
, , Xiaomi,
, Xiaomi.11.
Xiaomi User Experience.
.
, Sensor Data, , 61
( , . .) .
Xiaomi ,
. ,
Xiaomi.12,13. ,
.
, Xiaomi,
, .
SMS- . SMS-
Xiaomi ,
, Xiaomi.
, ,
. ,
SMS- .
; , .
Xiaomi Cloud , (,
, , SMS-, , , Wi-Fi . .) .
, , .
, Xiaomi (Security, MiBrowser, Cleaner, MIUI Package Installer Themes) MiAdBlacklistConfig , . , , ( MiAdBlacklistConfig 449 ). Xiaomi , , , MiAdBlacklistConfig.
Xiaomi ,
: MiAdBlacklist, . ,
, . ,
.
NCSC
.
11 12
, , .
1, (), , .
1. , .

Huawei P40
Android 10
(QKQ.200419.0P2) MIUI Global 12.0.10

MIUI 12.0.2.0
(RJSEUXM)
2021-05-25

Android; Huawei P40 Xiaomi Mi 10T
10, OnePlus 8T , 11.
, Android 11
,17 , .
Android - ,
,
, .
, , , (
), . 20 60
, CVE. , 5,4
10,0 ( 10 ).
.
Android , 1–3 .
Xiaomi 2 .18, OnePlus
3 .19. Huawei
14 15
Xiaomi. https://www.mi.com/global/service/support/security-update.html OnePlus. https://forums.oneplus.com/threads/oneplus-software- maintenanceschedule.862347/
. ,
Android, Google, Android Open
Source Project.
, Google.
, , Huawei, Xiaomi, OnePlus ,

,
. . ,
Huawei P40. ,
Xiaomi Mi 10T 3 ,
OnePlus 8T - 2 .
NCSC , , ,
.
Huawei AppGallery -,
, Huawei
. Huawei
,
AppGallery (APKMonk, APKPure, Aptoide
.). - Huawei 1.
1: - Huawei
5
Huawei : Huawei AppGallery . Huawei AppGallery , , , , , . , , . 20, Huawei 6-8 . Huawei 2.
2. Huawei
Huawei
ution

.:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
22 23
appdl-1-drcn.dbankcdn.com.c.cdnhwc1.com pay7.hicloud.com
appstore.huawei.com metrics2.data.hicloud.com
www.hicloud.com query.hicloud.com
80.158.19.100 80.158.19.121 80.158.20.103 80.158.23.247 80.158.40.92 101.33.11.29 101.33.11.45
163.171.128.127 163.171.128.129

36 37
AppGallery; ,
. Huawei
AppGallery 2.
Huawei AppGallery,
. « ». Petal Search,
, (1).
, (2).
,
Huawei AppGallery.
.
(3) ,
(4, 5).
, .
(6)
-. , ,
(7), . ,
, (8, 9), (10)
.
2: Huawei AppGallery
Huawei AppGallery,
7
,
.
, , ,
;
,
.
Huawei, , 3.
3: Huawei,
, , Huawei,
, . ,
, , ,
GDPR, ,
. .
- AppGallery, Huawei,
: APKMonk, Aptoide APKPure.
, APKMonk APKPure
. Aptoide21 ,
(), () .
,
Huawei. - Huawei
AppGallery ,
; -
, AppGallery.
, - AppGallery 38 ,
21 Aptoide. https://en.aptoide.com/company/about-us
8
APKMonk, 56 . Aptoide APKPure; 74 73 .
, Huawei ,
4.
4: Huawei
, , 5 7.
5: Huawei AppGallery
6: APKMonk

7: Aptoide

3. IP- .

.:
apkrep.ns1.ff. avast.com
ws75.aptoide.co
ws75.aptoide.co
appimg3.dbank cdn.com
appdl-11- dre.dbankcdn.
webservices.apt
. . unity3d.com
odr.mookie1.co
. . unity3d.com
13.107.213.4 4
52.177.138.1 13
appdl-11- drcn.dbankcd
n.com 152.199.21.2
. . unity3d.com9 en.aptoide.com 35.244.159.8
ws75.aptoide.co
apkrep.ns1.ff.av ast.com
11 5.62.36.56 id.rlcdn.com 65.9.52.144 -2-
drcn.dbankcd
download.apkp
10
n.com.cdn.dn sv1.com
www.petalsea rch.com
pagead2.google .com
www.apkmonk.
Quantcast.mgr.c onsensu.org
Firebaseremotec onfig.googleapi
- config.unityads.
www.datadoghq - agent.com
Firebase- settings.crashlyt
-
www.hicloud.
query.hicloud .
grs.dbankclou d.com
80.158.20.10 4
manager.com partner.googlea dservices.com
cation.com googleads4.g.do
bleclick.net28
Jos.hicloud.co
iap.hicloud.co
tpc.googlesyndi cation.com
cation.com31 80.158.54.98 172.217.21.130
-2-
pagead- googlehosted.lg

Firebase- settings.crashlyt
ics.com softonic.map.fas
160.44.207.2 13
image6.pubmati c.com
11
-4-

www.facebook.
CDN- mobile.aptoide.

firebaseinstallati ons.googleapis.
cm.g.doubleclic
store3.hispace.h icloud.com
fonts.gstatic.co
pagead- googlehosted.lg
oogle.com adservice.googl
sdkserver- dre.op.hicloud.c
sdkserver-
dre.op.hicloud.c om.edgekey.net
fonts.googleapis .
46 ads.mopub.com 185.64.190.78
47 j.mrpdata.net ads.mopub.com 212.82.100.176
-
metrics2.data.hi cloud.com
platform.hiclou d.com
grs.dbankcloud.
pixel.onaudienc e.com
D- 08.winudf.com
51 data.flurry.com green.erne.co
Netherlan
ds
55 160.44.199.4 id5-sync.com
56 160.44.202.175 51.255.81.18
57 2.18.33.213 3.66.135.160
tracking.justpre mium.com58 z.moatads.com
store3.hispace.h icloud.com
12
ads.api.vungle.c66 80.158.19.121 metrics2.data.hi
cloud.com OAuth--
dre.platform.db ankcloud.com
JFS- dre.jos.hicloud.
cloud.hicloud.c
appdlssl.hicloud .
ck.platform.hicl
4. VirusTotal.
VirusTotal
Android.fyben.a
14
,
.
() Google Play Store, . , . .
22 23
13
. 24 9.
9:
, , . . , Google Play Store.
, ( ), ; . , , . , . , .
, -, , .25.
, ,
, .
, , , () ; , .
24 Springer. Android . https://link.springer.com/article/10.1007/s11277-013-1258-x
P. Kotzias et al. ? Android. https://arxiv.org/pdf/2010.10088.pdf
25
14
2.
, , .
, Mi Browser : Google Analytics Sensors Data. Sensors Data - , Google Analytics. Sensors Data,26 1500 , , China Telecom, Baidu, CYTS, Sichuan Airlines . .
Google Analytics - , , iOS, Android -.27. Google Analytics , . , .
, , . .
Google. , Xiaomi User Experience.
, Xiaomi, , - Xiaomi Mi Browser. 5 Mi Browser, Google Analytics.
5. Mi Browser, Google Analytics. reportAsync(String str, Map <String, Object> map) {
(! TextUtils.isEmpty (str) & AMP; &!BrowserSettings.getInstance.isNotAllowCollectData) { BrowserReportUtils.stripUrlIfNeeded(); .postOnIOThread( Runnable (., ) { / * * / f $ 0;
.f0 . = r1;
FirebaseReportHelper.(.f $ 0, .f $ 1); }
}); } }
Firebase Google. 6 Sensors Data, Mi Browser. , Sensors Data Mi Browser.
6. Sensors Data Mi Browser
26
15
initSensorsDataAPI( Context context) {
(! = ) { applicationContext =
context.getApplicationContext;
{
,
61 ( ,
. .). , Sensors Data, 7.
7. 61 , Data.
.:
" "?
?

Xiaomi?

. Enhanced Incognito.

, .

11 12 13 14 15 16 17 18 19
swipe_up current_default_search_engine

-
.
Facebook
YouTube. ,

(, YouTube . .),
Mi
?
Adblock ? ?
- -
.

20 user_data_save_mode
21
42 43
browser_ads Protection_type
app_boot_third_party app_boot
MIUI Mi

" "?
Mi
Mi
51 bookmark_sync
52 history_sync
,
53 feature_report_switch
: YouTube . . 55 personal_service_switch
56 57
cookie .
, VPN, ,
Xiaomi.
, Xiaomi Base64,
urlencode .
8.
zzvhrYfjw6d% 2FA8RXtmQLWd2RTDyUWp5DBsFc55eI9yBbDROnrH12GSpq8SRDUtyJ8PquOrUqpsID g6qvSg% 2FksVvDG3gcl6SWzk9uL4hWhOCpEw% 2B% 2BzMBq0KCtqdOkn4kljhDgt CfdRixfrJe8PHTjr8x1cK5xMHHlSL0MK% 2FWu3utqKnuhf1UQGi64uYDCp% 2FeEZ1MdakDE% 2BLXsF 4wZKGiftO64% 2B8liP1NvxVl% 2BsgTutVEbroI% 2FWJUJkz9MfZyvL6OAPG6z9rRbJ354mUo6 % 2BOMwZdN% 2BAuWSzRz8IKITU6HwNZGMB0xmPDB8tSTM7ehnya% 2FyAiHPqOIXD7lYzrvupBJT rZLCXLQzbTgIxtZG65KvV7yfgiwMhCxY% 2Bkg0t3d0LXljOOrQqFfsqdJW% 2B6LnWvE6lKdm7% 2BCPydhautVIgiMSZDi94iH% 2FuYL% 2B2dkmLxSjQFQh51FSBA% 2BygRzfCItmL87KjjgT0t3% 2BmtvO% 2Bs93lH72rC6ai0Y5kdIIdSuIg6A% 2BomC73JYOeHygMR0jmjCjM5% 2FiUANqsH XPfeoaGBn8F% 2FV1vik03CPbetK3yzfwLn9ZpmkmzO64Ic% 2BEsRNTgNk7jc0mKZrsisWs4IPO1e
. .
9. , Xiaomi
{ «_Track_id»: 1687170607, Time: 1623852507838, 'type': track, "independent_id": "7d03ab71-91b1-47ca-8f56-0ce2d77f6c86", Lib: { $ Lib: Android, $ lib_version: «4.0.3-pre», $ app_version: '12 .4.1-g ', $ lib_method:' code ', «$ Lib_detail»: «com.android.browser.BrowserActivity #####»},
: «$ AppStart», : { $ Lib: Android, «$ Os_version»: '10',
18
$ lib_version: «4.0.3-pre», $ Model: «M2007J3SY», «$ s»: Android, «$ Screen_width»: 1080, $ screen_height: 2400, $ : 'Xiaomi', $ app_version: '12 .4.1-g ', : AndroidApp, miui_version: V12.0.18.0.QJDEUXM, log_miaccount: 0, 'miui_region': «LT», EID: «channel_en_youtube-web», «apk_name»: «com.mi.globalbrowser», «browser_install_referrer»: Google-play, «autocomplete_switch»: 1, «No_track_switch»: '2', bookmark_sync: 1, 'history_sync': 1, 'feature_report_switch': 1, «clear_data_switch»: 0, «personal_service_switch»: 1, «Enhanced_incognito_switch»: 0, 'hashtag_follow_count': 0,
'hashtag_follow_list': «», «Account_follow_count»: 0, «account_follow_list»: «», «feed_default_channel»: «», $ WiFi: True, $ network_type: WIFI, «$ resume_from_background»: True, «$ is_first_time»: false, «$ Screen_name»: «com.android.browser.BrowserActivity», $ title: «Mi Browser», «$ Is_first_day»: } }
https://sa.api.intl.miui.com. 10 , , . .
10. , Data

.:
1 2 3 4 5
, B , B , B
47.241.109.186 161.117.9.4
161.117.84.89 161.117.189.14
Xiaomi , ,
. ,
.
10 ,
19
, , .
10: , Xiaomi
Sensors Data, Mi:
registerSuperProperties registerDynamicSuperProperties. JSON. , gzip .
. AES128-CBC. . , AES, RSA , Xiaomi. JSON .
registerSuperProperties registerDynamicSuperProperties. JSON. , , .
Google Analytics, , Mi,

. TLS Protobuf.
Protobuf ,
: -, MI, , ,
, (, ).
Xiaomi.28
, Google Analytics, 11.
28 Xiaomi. https://privacy.mi.com/all/en_US/
20
event_network r: LT | 285
"Urlr"
r: LT | wifi_ifremind r
is_system_languager : LT | 1sourcer: LT | search_icon _oapp op
r: LT | show_scBrowserActivity _siçÈ¾å ° òTweb_translate_op²
«Ýæ / ñ®ý / event_network»
: LT | wifienter_wayr: LT | searchBar_website _oapp _scBrowserActivity _siçÈ¾å ° òT imp_search_page Îæýæ/ ú event_network
: LT | 323
12 , ,
Xiaomi Google Analytics.
12. , Google Analytics

.:
1 2 3
, B , B , B
142.250.74.110 172.217.16.14
21
29, 30, 31.
.
, , Xiaomi Mi 10T, globalapi.ad.xiaomi.com (IP- 47.241.69.153) JSON. MiAdBlacklistConfig . , MiAdBlacklistConfig , 13. 13. MiAdBlacklistConfig.

.:

29 30
22
11. MiAdBlacklistConfig
, , ( MiAdBlacklistConfig 449 ). MiAdBlacklistConfig 14.
14. MiAdBlacklistConfig.
.:
22 " ", « »,
. . .
. . .
"", " ",
" ",
23
. . .
. . .
. . .
449 " · " « »
Xiaomi , , , MiAdBlacklistConfig. 16.
16. , Xiaomi.
mo76794a(INativeAd iNativeAd, C8380a Avar) { (iNativeAd == ) { ;
} currentTimeMillis = System.currentTimeMillis; ( .: HashSet (.f11160b)) { (iNativeAd.getAdTitle! = &AMP;&m12161a (iNativeAd.getAdTitle, .)
) {MLog.m6439d (MiAdBlacklistConfig, : " + iNativeAd.getAdTitle + « :« + );
(! = ) {aVar. f11165a
;
;
);
;
;
Mi Browser , MiAdBlacklistConfig, MiAdBlacklistConfig. Xiaomi « ». , Mi Browser, 17.
17. , Mi Browser.
.:
24
M2007J3SY MIUI / V12.0.18.0.QJDEUXM) 3 4 5 6 7 8 9 10
MLog.d MLog.d MLog.d MLog.d MLog.d
: : :

AdSwitchOFF - . . .
{«MEvent»: «LOAD_AD», «mPositionId»: «1,306.1.3» , «MAppId»: «10000», «mChannelId»: «miui», «mOpera tor»: «246_01», «mClientVersion»: «100492», «mSdkV
ersion»: «130200», «mAdTime»: «1621431087190» , mModel: M2007J3SY, mGaid: «d3a32b43-6e7e-
4306-82ca- 0f65f1586511 »,« mLanguage »:« en_US »,« mBuildSdk »:« 29 »,« mDoNotTrack »:« false »,« mBuildTyp »
e »:« »,
065f520c1fa3 ”, «MIsPreload»: «false», «mCustomKey»: «adsCnt», «mC ustomValue»: «0», «mInstaller»: «com.xiaomi.discover»
»,« MIsPreInstall »: 0, mElapsed: 0, mIsid: 0}
,
.

23 : AdReportTask
24 : MIADSDK
25 : MIADSDK
. . .
{«MEvent»: «PAGE_VIEW», «mPositionId»: «1.306.1 . 3 »,« mAppId »:« 10000 »,« mChannelId »:« miui »,« mOp erator »:« 246_01 »,« mClientVersion »:« 100492 »,« mSd kVersion »:« 130200 »,« mAdTime »:« 1621431420870 ”
, mModel: M2007J3SY, mGaid: «d3a32b43-6e7e- 4306-82ca-
0f65f1586511 »,« mLanguage »:« en_US »,« mBuildSdk »:« 29 »,« mDoNotTrack »:« false »,« mBuildTyp »
e »:« »,
b71e-065f520c1fa3 », mInstaller:« com.xiaomi.discover »,«
38 : AdReportTask
, Xiaomi , ; MiAdBlacklist, . , , , . , ; ,
25
. , . , . , , , Xiaomi.
4. .
Xiaomi SIM-.
, Xiaomi Cloud,
, .
SMS- .
Xiaomi Xiaomi SMS-, 12.
Xiaomi ,
(1) Xiaomi.
(2), Xiaomi Cloud:
.
, ,
SIM- (3, 4 5). , SIM-,
(6), ,
SMS-
.
, SMS-
() .
, (7),
, SIM- SMS-.
(8).
server , , , SMS . SMS- , (9). .
SIM- (10). SMS- , , . (11).
26
12. Xiaomi
SMS
,
( ) (12).
, , : . , SMS- . Xiaomi Cloud . - 13.
27
13. Xiaomi Cloud
,
(1), .
, ,
(2). SMS- ,
(3).
(4). ,
, .
28
(5). , SMS- (6, 7). , , , -. , (8).
, SIM- , . SMS- ,
, , - api.account.xiaomi.com (IP-:
161.117.97.141). ,
. , . 18.
18.
/ / HTTP / 1.1
: application / x-www-form-urlencoded : Dalvik / 2.1.0 (Linux; U; Android 10; M2007J3SY MI / V12.0.18.0.QJDEUXM) APP / unknown MK / TWkgMTBU Cookie: sdkVersion = accountsdk-2020.01.09 : api.account.xiaomi.com : Keep-Alive : gzip
HTTP / 1.1 200 : , 5 2021 ., 09:48:42 GMT Content-Type:
application / json; charset = utf-8 Transfer-Encoding:

{«Result»: «ok», «code»: 0, «date»: {«» mo «: {» 460 (03 | 05 | 11) «: [» «10690329119863», «10690329119867», «10690329 119868» »,« 10690329119862 »,« 520 (05 | 18 | 47) »: [« »1614813«], »708 [0-9] +: [« + 50494340090 »,« 425 [0-9] +: [» + 972559882264 "]," 255 [0— <...> 9] +: ["+ 8804445652000", "+ 8804445652019"], "262 [0-9] +: [" + 4915735981865 "]," 216 [0-9] +: ["+ 36305555538", "450 [ 0-9] +: ["15996816", "246 [0-9] +: [”+ 37066803015 «,»206 [0- 9] +: [«+ 32460225522»], «226 [0-9] +: [» + 40371700668 «],» 440 [0-9] + «: [» + 819070094460 «,» 260 [0-9] +: [«+ 48666068953», «40 [45] [0-9] +: [» + 918652202112 «,» 56161974 «],» 502 (0 | 1 | 2 [0-9]) [0-9] * «: [» + 601117225668 «],» 250 [0-9] +: [«+ 79037672679», «+ 447491163442», <...> 9] +: «sgpac.account.xiaomi.com», «262 [0-9] +»: «sgpac.account.xiaomi.com», «216 [0-9] +»: «sgpac.account.xiaomi .com "," 450 [0-9] + ":" sgpac.account.xiaomi.com ","246 [0-9] +: "sgpac.account.xiaomi.com", "206 [0-9] +: «sgpac.account.xiaomi.com», «226 [0-9] +»: «sgpac.account.xiaomi.com», «440 [0-9] +»: «sgpac .account.xiaomi.com »,« 260 [0-9] + »:« sgpac.account.xiaomi.com »,« 40 [45] [0-9] +: «inac.account.xiaomi.com», ”502 (0 ~ 1 | 2 [0— <...>
SMS- , .
29
. Xiaomi SIM Activation Service , SMS-. SMS- 14.
14. SMS-
Xiaomi SIM Activation
Service , SMS-
miui.telephony.SmsManager,
.
SMS- 19.
19. SMS-. sendTextMessage(int i, String str2, String str3, PendingIntent pendingIntent, PendingIntent pendingIntent2) { {
<?> cls = Class.forName (miui.telephony.SmsManager)); cls.getDeclaredMethod ( getDefault, {Integer.TYPE}). Invoke (() ,
{Integer.valueOf (i)}); CLS.getMethod (sendTextMessage, {String. ,.,., PendingIntent. ,
PendingIntent. }.invoke (invoke, {., 2, str3, pendingIntent, pendingIntent2)); Log.d ( MiuSysImpl, « »); } (NoSuchMethodException e) {Log.e ( MiuSysImpl), « : NoSuchMethodException., );
RuntimeException (e); } (IllegalAccessException e2) {Log.e (MiuSysImpl), « : IllegalAccessException., e2);
RuntimeException (e2); } (InvocationTargetException e3) {Log.e (MiuSysImpl), « : InvocationTargetException., e3);
RuntimeException (e3); } (ClassNotFoundException e4) {Log.e (MiuSysImpl), « : ClassNotFoundException., e4);
RuntimeException (e4); } (SecurityException e5
) {ActivateLog.m24w (MiSysImpl, sendTextMessage,e5); }
30
15. SMS-, , miui.telephony.SmsManager
SMS- , , SMS- sgpac.account.xiaomi.com ().
SMS-
, , .
20.
20. , / / / HTTP / 1.1 Content-
Type: application / x-www-form-urlencoded
: 346
Encoding:
: keep-Alive
, ,
31
. 21.
21. , .
.:
,

: . , . .
1 api.account.xiaomi.com 161.117.97.141 9200

2 161.117.97.227 48990 ,
.

; ,
.
32 . https://thediplomat.com/2019/02/the-real-danger-of-chinas-national-intelligence-law/

Documents

NCSC при отделе инноваций и обучения MOND